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Response to Arguments 

Applicant's arguments filed December 19, 2005 have been fully considered but 
they are not persuasive. A discussion of the amended claims is provided below with 
respect to the prior art relied upon in the body of the rejection. 

Claim Rejections - 35 USC § 103 

The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 

obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed 
or described as set forth in section 102 of this title, if the differences between the 
subject matter sought to be patented and the prior art are such that the subject 
matter as a whole would have been obvious at the time the invention was made 
to a person having ordinary skill in the art to which said subject matter pertains. 
Patentability shall not be negatived by the manner in which the invention was 
made. 

Claims 1-48 are rejected under 35 U.S.C. 103(a) as being unpatentable over of 
Ginter et al. - hereinafter Ginter - (US 2002/01 12171) in view of Levergood et al. - 
hereinafter Levergood - (US 5,708,780). 

As per claim 1 , Ginter discloses the method of managing access by a client to 
user-specific information maintained in connection with a plurality of services, the 
method comprising: 

maintaining a plurality of items of user-specific information; ([001 7], [0043]) 
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obtaining a plurality of client access requests directed to accessing the plurality 
of items of user-specific information maintained in the more than one of the plurality of 
services, said plurality of access requests being translated from a task request that 
requires the client to access the plurality of items of user-specific information in order to 
complete the task request; ([0060]) and 

for each of the plurality of items of user-specific information required by the client 
to complete the task request: ([0627]; ROS 602 provided by the preferred embodiment 
extends conventional capabilities such as, for example, Control List (ACL) 

structures, to user and process defined events, including state transitions. ROS 602 
may provide full control information over pre-defined and user-defined application 
events. These control mechanisms include "go/no-go" permissions, and also include 
optional event-specific executables that permit complete flexibility in the processing 
and/or controlling of events. This structure permits events to be individually controlled 
so that, for example, metering and budgeting may be provided using independent 
executables. For example, ROS 602 extends ACL structures to control arbitrary 
granularity of information. Traditional operating systems provide static "go-no go" 
control mechanisms at a file or resource level; ROS 602 extends the control concept in 
a general way from the largest to the smallest sub-element using a flexible control 
structure. ROS 602 can, for example, control the printing of a single paragraph out of a 
document file.,) 

determining if the client has consent to access the item of user-specific 
information required by the client to complete the task request; ([0216]) 



Application/Control Number: 10/084,778 Page 4 

Art Unit: 2141 

filling the client access request directed to the item if the client has consent to 
access the item of user-specific information ([0216]) 

Ginter fails to disclose obtaining consent from a party having authority to grant 
access , if the client lacks access. Levergood discloses selectively obtaining consent, 
from a party having authority to grant access to the client, for the client to access the 
item of user-specific information if the client lacks consent as a function of said 
determining; and (Col 6 lines 36-57) At the time the invention was made, it would have 
been obvious to a person of ordinary skill in the art to obtain consent from a party 
having authority to grant access, if the client lacks access in the disclosure of Ginter. 
The motivation for doing do would have been to obtain a valid SID. (Col 5 lines 42-65) 

As per claim 2, Ginter / Levergood disclose the method of claim 1, and Ginter 
discloses initiating the task request requiring the client to access the plurality of items of 
user-specific information in order to complete the task request; (Col 5 lines 42-65) 

and translating the task request into the plurality of client access requests to 
complete the task request. ([0216]) 

As per claim 3, Ginter / Levergood disclose the method of claim 2, and Ginter 
discloses wherein selectively obtaining consent for the client to access the item of user- 
specific information comprises: 

identifying the task request, ([0935]) 

placing the identified task request in a task queue; and ([0935]) 
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displaying a consent menu to the identified party with authority, said consent 
menu prompting the identified party to grant or deny consent for the client to access the 
item of user-specific information for which the client lacked consent to access. ([0197]) 

Ginter fails to disclose obtaining consent from a party having authority to grant 
access, if the client lacks access. Levergood discloses identifying a party having 
authority to grant access to the client, for the client to access the item of user-specific 
information if the client lacks consent as a function of said determining; and (Col 6 lines 
36-57) At the time the invention was made, it would have been obvious to a person of 
ordinary skill in the art to obtaining consent from a party having authority to grant access 
, if the client lacks access in the disclosure of Ginter. The motivation would have been 
to obtain a valid SID. (Col 5 lines 42-65) 

As per claim 4, Ginter / Levergood disclose the method of claim 3 and Ginter 
discloses wherein the identified party with authority to grant consent is the user of the 
plurality of services offered by the web-services provider and wherein displaying the 
consent menu to the identified party comprises displaying the consent menu to the user. 
([0197]). 

As per claim 5, Ginter / Levergood disclose the method of claim 3 and Ginter 
discloses wherein the identified party with authority to grant consent is an owner of the 
item of user-specific information for which the client lacked consent to access and 
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wherein displaying the consent menu to the identified party comprises displaying the 
consent menu to the owner. ([1078]). 

As per claim 6, Ginter / Levergood disclose the method claim 5. Ginter discloses 
wherein the owner is the user of the plurality of services and wherein displaying the 
consent menu to the identified party comprises displaying the consent menu to the user. 
([0197]) 

As per claim 7, Ginter / Levergood disclose discloses the method of claim 3 and 
Ginter discloses wherein the user of the plurality of services is a managed user and the 
identified party with authority to grant consent is a manager of the managed user and 
wherein displaying the consent menu to the identified party comprises displaying the 
consent menu to the manager of the managed user. ([1078]) 

As per claim 8, Ginter / Levergood disclose the method of claim 3 and Ginter 
discloses wherein displaying the consent menu to the identified party comprises: 

displaying an indication of the item of user-specific information for which the 
client lacked consent to access; ([1961] - [1964]) 

displaying an identity of the client; and ([0218]) 

displaying an intended use of the client of the item of user-specific information for 
which the client lacked consent to access. ([1961] - [1964]) 
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As per claim 9, Ginter / Levergood disclose the method of claim 8 and Ginter 
discloses wherein displaying a consent menu to the identified party further comprises 
displaying a method of access requested by the client to complete the initiated task 
request. ([0197],[2181]) 

As per claim 10, Ginter / Levergood disclose the method of claim 8 and Ginter 
discloses wherein displaying a consent menu to the identified party further comprises 
displaying an indication of a status of each of the plurality of client access requests 
translated from the task request. ([1806]) 

As per claim 1 1 , Ginter / Levergood disclose the method of claim 8 and Ginter 
discloses wherein displaying a consent menu to the identified party further comprises 
displaying an indication of a status of each of the plurality of client access requests 
translated from the task request. ([01 97]) 

As per claim 12, Ginter / Levergood disclose the method of claim 3, and Ginter 
discloses identifying the plurality of client access requests to complete the task request, 
and identifying the item of user-specific information for which the client lacked consent 
to access. ([0196],[0197], [0216]) 

As per claim 13, Ginter / Levergood disclose the method of claim 3, and Ginter 
discloses 
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providing a consent acceptance message being indicative of whether the 
identified party granted consent for the client to access the item of user-specific 
information for which the client lacked consent; and ([1346]) 

updating an access control list associated with the item of user-specific 
information for which the client lacked consent if the consent acceptance message 
indicates that the identified party granted consent, whereby upon updating said access 
control list, the client has consent to access the item of user-specific information 
([0627]) 

As per claim 14, Ginter / Levergood disclose the method of claim 13 and Ginter 
discloses further comprising removing the identified task from the task queue if the 
consent acceptance message indicates that the identified party granted consent. 
([0935],[1112]) 

As per claim 15, Ginter / Levergood disclose the method claim 13, and Ginter 
discloses the method of claim 13 further comprising transmitting a consent success 
message to the client, said consent success message being indicative of whether the 
identified party granted consent for the client to access the item of user-specific 
information for which the client lacked consent. ([1346]) 
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As per claim 16, Ginter / Levergood disclose the method of claim 13, and Ginter 
discloses wherein updating the access control list further comprises setting a time limit 
in which the client has consent to access the item of user-specific information. ([1574]) 

As per claim 17, Ginter / Levergood disclose the method of claim 3, and Ginter 
discloses wherein displaying the consent menu to the identified party displaying an 
invitation to allow the client enjoy a one-time only access to the item of user-specific 
information for which the client lacked consent. ([1 153]) 

As per claim 18, Ginter / Levergood disclose the method of claim 3, and Ginter 
discloses wherein selectively obtaining consent for the client to access the item of user- 
specific information farther comprises sending an alert message to the party with 
authority to grant consent, said alert message alerting the party with authority to grant 
consent that the client seeks access to the item of user-specific information for which 
the client lacked consent. ([1825]) 

As per claim 19, Ginter / Levergood disclose the method of claim 3, and Ginter 
discloses the method of claim 3 further comprising: 

providing a consent acceptance message being indicative of whether the 
identified party granted consent for the client to access the item of user-specific 
information for which the client lacked consent; ([1346]) 
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granting consent to allow the client to access the item of user-specific information 
if the consent acceptance message indicates that the indicated party granted consent. 
([0627]) 

As per claim 20, Ginter discloses the method of claim 1 , wherein one or more 
computer-readable media having computer-executable instructions for performing the 
method recited in claim 1. ([0016]) 

As per claims 21-48, please see the discussion above as they relate to the same 
rationale and subject matter as above. 

Conclusion 

THIS ACTION IS MADE FINAL. Applicant is reminded of the extension of time 
policy as set forth in 37 CFR 1.136(a). 

A shortened statutory period for reply to this final action is set to expire THREE 
MONTHS from the mailing date of this action. In the event a first reply is filed within 
TWO MONTHS of the mailing date of this final action and the advisory action is not 
mailed until after the end of the THREE-MONTH shortened statutory period, then the 
shortened statutory period will expire on the date the advisory action is mailed, and any 
extension fee pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of 
the advisory action. In no event, however, will the statutory period for reply expire later 
than SIX MONTHS from the mailing date of this final action. 
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The prior art made of record and not relied upon is considered pertinent to 
applicant's disclosure. The prior art made of record and not relied upon is considered 
pertinent to applicant's disclosure. These references are disclosed in the Notices of 
References cited page and teach methods for user-centric consent management 
system and method. A close review of these references is recommended. 

Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Chirag R. Patel whose telephone number is (571)272- 
7966. The examiner can normally be reached on Monday to Friday from 7:30AM to 
4:00PM. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Rupal Dharia, can be reached on (571) 272-3880. The fax phone number 
for the organization where this application or proceeding is assigned is 571-273-8300. 

Information regarding the status of an application may be obtained from 
the Patent Application Information Retrieval (PAIR) system. Status information 
for published applications may be obtained from either Private PAIR or Public 
PAIR. Status information for unpublished applications is available through 
Private PAIR only. For more information about the PAIR system, see 
http://pairdirect.uspto.gov. Should you have questions on access to the Private 
PAIR system, contact the Electronic Business Center (EBC) at 866-217-9197 
(toll free). 




